Keel MCP server

by lutfizp·io.github.lutfizp/keel·v0.3.0·2 stars

No reviews yet

Control plane MCP that dedups scanner output, rate-limits hosts, and runs non-destructive proofs.

A88/100grade A

Write a review Install

What users say

No reviews yet

Be the first

Safety scan

A88/100

full report

Adoption

Growing

2 stars22 downloads/wk

Reviews

Write one

Nobody has reviewed Keel yet.

If you have run it, two minutes of your experience saves the next person an afternoon.

Keel tools (13, 3 write)

write = sends, deletes, buys or posts

Read from the package source without running it. The installed server may list more.

assess_exploitability
Explain candidate impact, missing evidence, controls, and safe proof options.
begin_engagement
Register exact/wildcard scope and bounded traffic policy.
cancel_wavewrite action
Request cancellation of a queued or running scanner process.
draft_proof
Describe an allowlisted proof without sending traffic.
draft_waves
Draft reachability plus one micro-wave per reviewed template; no traffic.
engagement_audit
Return recent append-only application audit events for one engagement.
engagement_health
Report registered engagements, cooldowns, and pending waves.
execute_proofwrite action
Run a proof bound to an operator-approved target, credentials, and canary hash.
execute_wavewrite action
Start one admitted wave in the background and return its persistent job.
query_cards
Return hunter-relevant cards. Informational and hardening are hidden by default.
second_look
Start a background micro-wave using only the originating template.
state_impact
Record hunter impact_class and preconditions on a card.
wave_status
Return one job, or list persistent jobs/waves when job_id is omitted.

Public scan report

scanner v0.1.10 · 2026-10-31 · same rubric, same numbers if you re-run it

no findings

Code scan42 source files scanned25/25
–Live reliabilityno gateway calls yet and no remote to proben/a
–Tool poisoningtools not inspected (local package is not executed); not countedn/a
Auth qualitylocal package, no credentials required12/15
Maintenancelast push 67 days ago12/15
Maintainer identityregistry namespace matches repository owner; GitHub account older than a year8/10

Overall 88/100. Components that don't apply are left out of the denominator. Any critical finding is an F.Rubric Appeal a finding JSON

How Keel compares

Against every graded MCP server, from our own scans and uptime checks. Updated after each scan run.

Safety score: 88/100; higher than 75% of 48,255 servers
Tools: 13; the typical server has 7
Tools that change things: 23%; typical: 0%. Fewer write tools means less an agent can break
GitHub stars: 2; more than 75% of 28,688 servers
Downloads a week: 22; more than 8% of 12,191 servers with a package

What its tools let an agent do: 10 read · 1 delete · 2 run or deploy

Install Keel in Claude Code, Cursor or VS Code

claude mcp add keel -- uvx keel-pentest

Add to Cursor

What the publisher says

From the Keel repository's README, as published. We do not edit it. Read it on GitHub

Keel

The MCP control plane that turns scanner noise into hunter-grade, non-destructive proofs

Thirteen MCP tools. Semantic dedup. Per-host rate limits. Safe proofs that show what a hunter can do — without damaging the target.

Why Keel · Install · Clients · Proofs · Tools

Dumping 150 tools on an agent is easy. The hard problems are dedup across tools, exploitable vs noise, and not hammering the target. Keel is the control plane for those three.

An AI client talks to Keel, not to httpx, nuclei, or a shell. Keel drafts one wave at a time, enforces scope and rate limits, merges scanner hits into semantic cards, and runs GET-only playbooks on tester-owned data. When a playbook returns proven, you get a curl replay a hunter can follow — still without writes, shells, or payload spam.

Use it on programs you are authorized to test.

Why Keel

A wrapper that shells out to a huge toolbox does not have that layer. Keel does — in the scheduler, in the adapters, and in the proof broker.

Architecture

flowchart TD
    A[AI coding client] -->|stdio MCP| B[Keel]
    B --> C[Scope and rate gate]
    C --> W[Background job and wave scheduler]
    W --> H[httpx: one target]
    W --> N[nuclei: HTTP templates, bounded]
    C --> P[Proof broker: GET only]
    P --> T[Tester-owned resource]
    H --> S[Semantic card store]
    N --> S
    P --> S
    S --> Q[Triage and evidence states]

begin_engagement with the hostname you are authorized to test.
draft_waves proposes reachability plus template micro-waves. No traffic yet.
executewave returns a job immediately. Poll wavestatus. cancel_wave kills the scanner.
querycards returns hunter-relevant cards. assessexploitability says what would prove it.
draftproof then executeproof run a GET-only playbook against tester data. proven means the invariant held. protected means the control worked.

Installation

macOS (Homebrew). pipx is a separate tool — install it first. Apple's /usr/bin/python3 is often 3.9 and cannot install Keel.

brew install pipx python@3.12
pipx ensurepath

Shortened. The full README is on GitHub.

Nothing above is checked by us. What we check is on the safety report.

Keel: common questions

Is Keel MCP server safe?: Yes, by our scan: it is graded A (88/100). Read the Keel safety report
How do I install Keel?: It runs on your machine. Copy the Claude Code, Cursor, VS Code or Claude Desktop config from the install section.
Does Keel need an API key?: Not as far as the registry entry and our scan can tell: no credentials are declared or required.
Is Keel maintained?: The last commit was 71 days ago (2026-08-25). The latest release is v0.3.0.
How does Keel compare with other MCP servers?: safety score 88/100 (higher than 75% of 48,255 servers); tools 13 (the typical server has 7); tools that change things 23% (typical: 0%. Fewer write tools means less an agent can break). Full comparison.